Description of problem:

One of our customers reported a problem with tripleo_swift_rsync_healthcheck running on RHOSP director: this healthcheck calls lsof command which triggers SELinux denials (would provide them privately to avoid customer's data exposure). It looks like denials come from the fact that lsof command tries to access block device.

At the same time affected healthcheck is used to confirm that appropriate process is listening on appropriate port, so a call related to block device looks like a side effect to me.

[1] https://opendev.org/openstack/tripleo-common/src/branch/stable/train/healthcheck/swift-rsync
~~~
$ cat -n healthcheck/swift-rsync
     1	#!/bin/bash
     2	
     3	. ${HEALTHCHECK_SCRIPTS:-/usr/share/openstack-tripleo-common/healthcheck}/common.sh
     4	
     5	process='rsync'
     6	args="${@:-873}"
     7	
     8	if healthcheck_listen $process $args; then
     9	    exit 0
    10	else
    11	    ports=${args// /,}
    12	    echo "There is no $process process, listening on port(s) $ports, running in the container."
    13	    exit 1
    14	fi
~~~

[2] https://opendev.org/openstack/tripleo-common/src/branch/stable/train/healthcheck/common.sh#L85-L93
~~~
$ cat healthcheck/common.sh
...
    85	healthcheck_listen () {
    86	    process=$1
    87	
    88	    shift 1
    89	    args=$@
    90	    ports=${args// /,}
    91	    pids=$(pgrep -d ',' -f $process)
    92	    lsof -n -w -P -a -p${pids} -iTCP:${ports} -s TCP:LISTEN >&3 2>&1
    93	}

# lsof -n -w -P -a -p7 -iTCP:873 -s TCP:LISTEN
COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
rsync     7 root    4u  IPv4 591056      0t0  TCP 192.168.24.1:873 (LISTEN)


Kindly ask you to take second look. Sosreport from affected node is attached to support case.


Version-Release number of selected component (if applicable):
Red Hat OpenStack Platform release 16.2.0 GA (Train)

How reproducible:
Healthcheck triggers SELinux warning.